Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊
'Often times after the initial compromise in a BEC attack the attackers create inbox rules to delete emails that contain certain keywords related to their BEC attack. This is done so as to limit ability to warn compromised users that they've been compromised.
| Attribute | Value |
|---|---|
| Type | Analytic Rule |
| Solution | Business Email Compromise - Financial Fraud |
| ID | 8ac77493-3cae-4840-8634-15fb23f8fb68 |
| Severity | Medium |
| Kind | Scheduled |
| Tactics | Persistence, DefenseEvasion |
| Techniques | T1098, T1078 |
| Required Connectors | Office365 |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
OfficeActivity |
✓ | ✗ | ? |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊
↑ Back to Analytic Rules · Back to Business Email Compromise - Financial Fraud